CN111434088A

CN111434088A - Data processing method

Info

Publication number: CN111434088A
Application number: CN201880078469.3A
Authority: CN
Inventors: S·林兰德; F·斯卡希尔; T·特维尔
Original assignee: British Telecommunications PLC
Current assignee: British Telecommunications PLC
Priority date: 2018-01-08
Filing date: 2018-12-21
Publication date: 2020-07-17
Anticipated expiration: 2038-12-21
Also published as: US20200336469A1; CN111434088B; EP3738286B1; EP3738286A1; US11336623B2; WO2019134858A1

Abstract

A method of processing a data packet received by a packet sniffer (401), the data packet comprising an associated identifier (402), the method comprising: transmitting the data packet to a recipient, determining whether the identifier corresponds to a particular network, wherein if it is determined that the identifier corresponds to the particular network, providing the identifier to the recipient; and if it is determined that the identifier does not correspond to the particular network, the identifier is not provided to the recipient (403).

Description

Data processing method

In order to perform diagnostics on a device, a packet sniffer may be used that captures copies of data packets sent by neighboring devices and uploads these copies to a server for diagnostic processing.

In such an arrangement, the sniffer may capture data packets from a third party owned device (rather than the user owned). These third party data packets affect the communication environment. For example, a third party may be downloading a large amount of data, thus reducing the bandwidth available to the user's device. Therefore, it is desirable to include third party data packages in the diagnostic process.

According to a first aspect of the present invention, there is provided a method of processing a data packet received by a packet sniffer, the data packet comprising an associated identifier, the method comprising:

the data packet is transmitted to the receiving party,

determining whether the identifier corresponds to a particular network;

wherein if it is determined that the identifier corresponds to the particular network, providing the identifier to the recipient; and is

If it is determined that the identifier does not correspond to a particular network, the identifier is not provided to the recipient.

Uploading third party data to a server, where the data contains identity information about the third party, causes privacy concerns and is therefore undesirable. These privacy issues may be avoided by, for example, removing identity information from the data packet before uploading the data packet to the server. However, this prevents the diagnostic process from identifying client devices that are not performing properly. The invention enables a method to be performed in which both client data and third party data are made available for diagnostic analysis at a recipient server without violating the privacy of the third party. Since identity information about the third party is not sent to the server, the privacy of the third party is not violated.

The step of providing the identifier to the recipient may be performed after the recipient receives the data packet. The data packet may not contain an identifier when it is sent to the recipient. The step of providing the identifier to the recipient may be performed separately from the step of sending the data packet to the recipient. The step of providing the identifier to the recipient may comprise sending a data file containing the identifier to the recipient, the data file being different from the data package.

In a presently preferred embodiment, the step of transmitting the data packet to the recipient comprises providing the identifier to the recipient in encoded form. The encoded identifier may be transmitted to the recipient as part of a data packet. The encoded identifier may be in the form of a reference code. The step of providing the identifier in encoded form to the recipient may comprise overwriting the identifier with the encoded identifier. The step of transmitting the data packet to the receiving side may be performed through a wired channel.

In some embodiments, the data packet contains a single identifier. The identifier may include a MAC address. Alternatively, the identifier may comprise an SSID. In a presently preferred embodiment, the data packet contains a plurality of identifiers. In embodiments where the data packet comprises a plurality of identifiers, the method may be performed in respect of each of the plurality of identifiers. The plurality of identifiers may include one or more MAC addresses and/or one or more SSIDs. The plurality of identifiers may include three to six MAC addresses. Each MAC address may correspond to any of: the device from which the packet originated, the device that sent the packet, the device to which the packet was sent, and the device that is the ultimate destination of the packet. The plurality of identifiers may include one or more SSIDs.

The method may further include receiving a packet including the identifier and a reference code, the packet including the identifier and the reference code, and transmitting the packet to a receiver, the packet including the identifier and the reference code, the decoding information being recorded in a table.

The step of determining whether the identifier corresponds to a particular network may include comparing the identifier to a list of devices that have been associated with the particular network. The device list may be provided by an access point of the network. If it is determined that the identifier does not correspond to a particular network, the identifier and the decoding information associated with the identifier may be deleted from the record.

The sniffer may be adapted to capture a copy of the wirelessly transmitted data packet. The sniffer may be located near an access point of the network.

The receiver may receive the transmitted data packet and may transmit the received data packet to another receiver for diagnostic processing.

The method may include a preliminary determination step of determining whether the identifier corresponds to a particular network before performing the step of transmitting the data packet to the recipient. In a presently preferred embodiment, the data packet sent to the recipient contains the identifier in non-encoded form if it is determined in this preliminary determination step that the identifier corresponds to a particular network. If it is determined in this preliminary determination step that the identifier does not correspond to a particular network, the method proceeds according to the presently preferred embodiment of the invention defined above. In an alternative embodiment, the data packet sent to the recipient contains the identifier in encoded form if it is determined in this preliminary determination step that the identifier corresponds to a particular network.

The method may be performed by a data processing device, which may be associated with a sniffer and may be adapted to perform the method on data packets received by the relevant sniffer. The data processing device may comprise a member device of a particular network and may comprise an access point to the particular network. The sniffer may be adapted to capture data packets from the access point. In some embodiments, the method is performed at more than one location. In these embodiments, there may be a plurality of data processing devices, each of which may have an associated sniffer.

If data packets received at more than one sniffer contain the same identifier, the identifier may be sent to the receiving party in the same encoded form. This makes the process of decoding the encoded identifier less problematic. An initial coded form may be assigned to the identifier. The initial encoding form may be replaced by a master encoding form.

According to a second aspect of the present invention, there is provided a network device adapted to process data packets, the network device comprising

A transmitter adapted to transmit the data packet to a recipient;

a determiner adapted to determine whether the identifier corresponds to a particular network;

wherein if the determiner determines that the identifier corresponds to a particular network, the network device is adapted to provide the identifier to the recipient; and is

If the determiner determines that the identifier does not correspond to a particular network, the network device is adapted to not provide the identifier to the recipient.

The network device is further adapted to perform all the steps of the method according to the first aspect of the invention as defined above.

For purposes of illustration only, specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, in which:

FIG. 1 is a schematic illustration of L AN adapted to perform a method in accordance with the present invention, the L AN comprising a single access point;

FIG. 2 is a schematic illustration of a data packet on which a method according to the invention may be performed;

FIG. 3 is a schematic illustration of a look-up table used in the method according to the invention;

FIG. 4 is a flow chart illustrating an embodiment of a method according to the present invention;

fig. 5 is a schematic diagram of L AN adapted to perform a method according to the invention, the L AN comprising two access points.

Detailed Description

A schematic representation of a typical wireless L AN is shown in fig. 1 and indicated at 1. in particular, L AN 1 includes a plurality of client devices 2. these will be referred to as L AN clients 2. these L AN clients 2 are part of L AN 1 and are associated with access point 4. in particular, L AN clients 2 are capable of wirelessly transmitting packets 3 to access point 4 and wirelessly receiving packets 3 from access point 4. it is noted that, although the example L AN 1 shown in fig. 1 includes only one access point 4, L AN 1 may include more than one access point 4.

Fig. 1 also shows a third party device 5 located outside L AN 1, this third party device 5 is not part of L AN and therefore is not associated with access point 4 (although the third party device 5 may be part of its own third party L AN (not shown in the figure)).

Fig. 1 also shows a sniffer 60. the sniffer 60 is located near the access point 4 and is able to wirelessly receive data packets 3 from L AN both the client 2 and the third party device 5. the sniffer 60 can process the data packets 3 it receives and can upload the data packets 3 to the server 7. when the third party device 5 wirelessly sends data packets 3, such data packets 3 can be received by the sniffer 60. the sniffer 60 uploads both the client data packets 3 and the third party data packets 3 to the server 7.

Fig. 2 is a schematic representation of a typical data packet 3 used according to the invention. In particular, there is a header 20, which header 20 contains, among other things, a MAC address 21 and an SSID 22. Although only one MAC address is shown, a typical packet has from one to six MAC addresses. These MAC addresses include the MAC addresses of the device from which the packet 3 originates, the device that sent the packet, the device that will next receive the packet, and the device that is the ultimate destination of the packet 3. Furthermore, although one SSID is shown in fig. 2, the data packet 3 may have zero, one, or more than one SSID. Further, the MAC address and SSID may be located in the header or body of the packet 3.

The payload 23 of packet 3 is also shown in fig. 2 the payload 23 may contain, among other things, EAPo L data 24 EAPo L data 24 is used in the process of authenticating the sender of packet 3.

In some known systems, diagnostic processing of the type of L AN shown in fig. 1 includes a sniffer that sends packets of all data (i.e., both client packets and third party packets) to the server 7, whereby diagnostic processing is applied to the packets with the intent of determining whether the client device is performing efficiently.

The present invention anonymizes some or all of the MAC address and SSID in the data packet 3 before sending the data packet 3 to the server 7 for diagnostic processing. A first embodiment of the present invention will now be described.

In a first embodiment of the invention, the packet 3 is received by the sniffer 60, the MAC address 21 and SSID22 on the packet are read, the sniffer 60 receives information from the access point 4 about which devices are L AN 1 client devices 2 if the MAC address 21 and SSID22 indicate that the packet 3 was sent by L AN 1 client devices 2, then the MAC address 21 and SSID22 are not anonymized (i.e. they are not overwritten by the MAC code 10 and SSID code 11) before being sent to the server 7, but rather the packet is sent to the server in a non-anonymous form with the MAC address 21 and SSID 22. these packets are stored at the sniffer 60 and then sent to the server 7 in batches the MAC address and SSID22 of the packet are entered into the lookup tables 14, 15 with a flag indicating that the device has been associated with L AN.

If the MAC address 21 and SSID22 indicate that the packet 3 was sent by a device other than the client device 2 of L AN 1, then the sending device must be either (i) a third party device, or (ii) a device that is part of the network, but at the time of sending, the sniffer 60 has not observed that the device has successfully associated to L AN 1.

If the MAC address 21 and SSID22 indicate that the packet 3 received at the sniffer 60 was sent by a device other than the client device 2 of L AN 1, the MAC address 21 is entered into the look-up table 14 (see fig. 3) then a reference code (referred to as MAC code 10) is assigned to each MAC address the MAC code 10 may have a simple form (e.g., MAC-1) the MAC code 10 enters into the look-up table 14 in the same row as its corresponding MAC address 21 but into the second column then the MAC address 21 in the packet 3 is overwritten by its assigned MAC code 10.

A similar method is then applied to the SSID22 of the data packet. In particular, one or more SSIDs 22 from the data packet 3 are entered into the second look-up table 15. Then, a reference code (which will be referred to as SSID code 11) is assigned to each SSID 22. The SSID code 11 enters the same row of the lookup table 15 as the SSID22, but enters the second column. Each SSID22 in the data packet 3 is then overwritten by its corresponding SSID code 11.

The data packet is truncated to remove the payload 23. In this way, the payload 23 is not uploaded to the server 7 (as uploading the payload of a third party data package to the server may violate the privacy of the third party).

If the access point 4 indicates to the sniffer 60 that a successful authentication has occurred between the client device 2 and L AN 1, a flag is set in the look-up tables 14, 15 next to the MAC address/SSID corresponding to this device 2. this flag is set in the "L AN device" column 50 of the look-up tables 14, 15 (see fig. 3). the sniffer 60 periodically sends a batch of anonymized data packets 3 to the server 7. when it is desired to send such a batch of data packets, a copy of each look-up table in the look-up tables 14, 15 is made. all entries in the L AN device column that do not have a flag are deleted (or "trimmed") from the copy of the look-up tables 14, 15. these trimmed look-up tables are sent to the server together with this batch of anonymized data packets 3. the server uses the trimmed look-up tables 14, 15 to de-anonymize the anonymized MAC address and SSID in the anonymized data packets 3 it receives. the trimmed look-up tables 14, 15 contain the anonymized MAC address and SSID corresponding to the MAC code 10 that was most recently associated with the client device (the ad-up table) and hence the third party device is not able to prevent its attack on the third party MAC address or SSID.

In a second embodiment of the invention, the MAC addresses and SSIDs of all packets 3 received at the sniffer 60 are anonymized, not just those corresponding to devices not associated to L AN 1. this anonymization is as described in relation to the first embodiment. in particular, when any packet is received at the sniffer 60, the MAC address 21 of the packet 3 is entered into the look-up table 14 (see FIG. 3). then, the MAC code 10 is assigned to each MAC address and entered into the same row of the look-up table 14 as its corresponding MAC address 21, but into the second column. then, the MAC address 21 in the packet 3 is overwritten by its assigned MAC code 10. zero or more SSIDs 22 from the packet 3 are entered into the second look-up table 15. then, SSID code 11 is assigned to each SSID 22. SSID code 11 is entered into the same row of the look-up table 15 as SSID22, but then into the second column. SSID code 22 in the packet 3 is overwritten by its corresponding SSID code 11.

As in the first embodiment, the data packet is truncated to remove the payload 23. In this way, the payload 23 is not uploaded to the server 7 (as uploading the payload of a third party data package to the server may violate the privacy of the third party).

If the MAC/SSID of the packet 3 received by the sniffer 60 corresponds to a device which can be determined to be part of L AN 1, a flag is set in the look-up tables 14, 15 next to the MAC address/SSID corresponding to this device 2. a flag is set in the "L AN device" column 50 of the look-up tables 14, 15 (see fig. 3). if the device 2 is not associated with L AN 1 at the start of the session, a MAC address/SSID entry will be entered into the look-up tables 14, 15, but not any flag will be entered. if the device 2 is associated with L AN 1 during the session, when the sniffer 60 receives a packet containing the MAC address/SSID corresponding to this device, the sniffer 60 will detect that the corresponding device 2 is now associated with L AN 1 and will therefore enter a flag into the look-up tables 14, 15 next to the MAC address/SSID corresponding to this device, so in this second embodiment, a set for the MAC address/SSID corresponding to the device pair) next to the anonymous packet sent from the look-up table 14, 15, and a periodic sniffer will send a copy of this sniffer 14, a packet to the anonymous look-up table 14, 15, which has been sent from the anonymous copy, a server, a, which had no such a sniffer 14, a list, which had been created when the sniffer had been received, has been created, a, has been created, a copy, a packet, has been sent from the sniffer, a list, has been sent, a list of all the sniffer 14, has been created, a list 3, has been created, and a list of all the sniffer 14, has been created when the anonymous copy of the sniffer 14, has been created, has been.

Thus, the trimmed look-up tables 14, 15 uploaded to the server contain only the MAC code 10 and SSID code 11 corresponding to devices associated with L AN 1. the trimmed look-up tables do not contain the MAC code 10 or SSID code corresponding to third party devices.

The method is performed at a data processing device. The data processing device receives data packets from the associated sniffer and processes the data packets according to the invention.

Fig. 4 is a flow chart summarizing the steps according to a second embodiment of the invention and including the following steps. Step 401: sniffer 60 receives data packet 3. Step 402: the MAC address 21 and SSID22 of the data packet 3 and their corresponding assigned codes are entered into a look-up table. Step 403: the MAC address 21 and SSID22 are overwritten in the header of the data packet 3 with the respective assigned codes. Step 404: the data packet 3 is sent to the server 7. Step 405: in the fourth column of both look-up tables 14, 15, a flag is set for all entries corresponding to data packets 3 sent by the client device 2. Step 406: all unmarked entries are deleted from the look-up tables 14, 15. Step 407: both look-up tables 14, 15 are sent to the server 7.

Multi-sniffer arrangement

In some embodiments, there is more than one data processing device associated with a particular network, each of the data processing devices having an associated sniffer (see fig. 5). The respective

data processing device

160, 260 performs the method according to the invention as described above. The inventors have realized that if data packets containing the same MAC address or SSID are processed by different processing devices, there is a risk that the respective data processing devices assign different reference codes to the MAC address or SSID. This may mean that the MAC address or SSID cannot be decoded correctly at the server. It is therefore desirable to ensure that the same reference code is assigned to the same MAC address or SSID. To achieve this, one data processing device is defined as a master device 160 and the other data processing devices are defined as slave devices 260. Only one slave device 260 is shown in fig. 5. When the data packet 103 is processed by the slave device 260, the slave device 260 assigns an initial reference code to each MAC address/SSID and transmits the reference code and MAC address/SSID to the master device 160. If the master device 160 has previously received the MAC address/SSID, the master device 160 sends its reference code assigned to the MAC address/SSID to all slave devices 260. If the primary device 160 has not previously received the MAC address/SSID, the primary device 160 assigns a reference code to the MAC address/SSID. The master device 160 then (i) sends its assigned reference code to all slave devices, which replace any initial reference codes they have assigned with the master reference code in the data packet 103 and the look-up table; or (ii) enter the master reference code and the initial code of the slave into a mapping table (not shown). In arrangement (i), the server 107 decodes the MAC address/SSID in the data packet 103 it receives using separate look-up tables for the master and slave devices. In arrangement (ii), the server 107 uses the mapping table to decode the MAC address/SSID in the packet 103 it receives.

Claims

1. A method of processing a data packet received by a packet sniffer, the data packet comprising a correlation identifier, the method comprising: sending the data packet to a recipient, determining whether the identifier corresponds to a particular network; wherein if it is determined that the identifier corresponds to the particular network, the identifier is provided to the recipient; and not providing the identifier to the recipient if it is determined that the identifier does not correspond to the particular network.

2. The method of claim 1, wherein the step of transmitting the data packet to a recipient comprises providing the identifier to the recipient in an encoded form.

3. A method according to claim 1 or 2, wherein the data packet contains a plurality of identifiers and the method is performed in respect of each of the plurality of identifiers.

4. The method of any preceding claim, wherein the plurality of identifiers comprises one or more MAC addresses.

5. The method of claim 4, wherein the plurality of identifiers comprises three to six MAC addresses, including three and six.

6. The method of any preceding claim, wherein the plurality of identifiers comprises one or more SSIDs.

7. A method according to any preceding claim, wherein the step of providing the identifier to a recipient comprises sending decoding information to the recipient to enable the encoded identifier to be decoded.

8. The method of claim 7, wherein the decoding information comprises a reference code.

9. The method of claim 7 or 8, wherein the decoding information is recorded in a table.

10. The method of any of claims 7 to 9, wherein the decoding information is sent to the recipient separately from the data packet.

11. The method of any preceding claim, wherein the recipient is a server.

12. The method of any preceding claim, wherein the particular network is L AN.

13. A method according to any preceding claim, wherein the method further comprises removing some or all of the payload of the data packet before sending the data packet to the recipient.

14. A network device adapted to process data packets, the network device comprising: a transmitter adapted to transmit a data packet to a recipient; a determiner adapted to determine whether the identifier corresponds to a particular network; wherein the network device is adapted to provide the identifier to the recipient if the determiner determines that the identifier corresponds to the particular network; and if the determiner determines that the identifier does not correspond to the particular network, the network device is adapted to not provide the identifier to the recipient.